Package manifest
What is installed, where it is declared, and why. Choices follow requirement 17 (performance and security
first, Rust implementations preferred) and the operator’s existing configs. Items that need an explicit
decision are opt-in via my.features.<name> = true (set in my/private.nix); everything else is on.
System (modules/nixos/)
Section titled “System (modules/nixos/)”| Area | Packages / modules | Notes |
|---|---|---|
| coreutils | uutils-coreutils-noprefix (hiPrio), uutils-findutils, uutils-diffutils | Rust coreutils ahead of GNU in PATH (base-packages.nix) |
| privilege | sudo-rs | memory-safe sudo/su (hardening/permissions.nix) |
| base tools | git, file, tree, pciutils, usbutils, smartmontools, cryptsetup, btrfs-progs, lm_sensors | |
| boot/crypto | sbctl (lanzaboote), systemd-cryptenroll (systemd) | boot-crypto.nix |
| YubiKey | pcscd, yubikey-manager, age-plugin-yubikey, age, sops | yubikey.nix |
| peripherals | usbguard + usbguard-notifier, fwupd, bluez | hardening/peripherals.nix |
| sandboxing | apparmor + apparmor-profiles, flatpak, xdg-desktop-portal, bubblewrap | hardening/sandbox.nix |
| network | NetworkManager, iwd, systemd-resolved, nftables, mihomo (+ metacubexd UI) | hardening/network.nix |
| desktop | Plasma 6, SDDM, PipeWire/WirePlumber | desktop-kde.nix (elisa, khelpcenter excluded) |
| input/fonts | fcitx5 (rime, mozc), Noto/Noto CJK/Sarasa/Fira Code/JetBrains Mono (+ Nerd) | locale-fonts.nix |
| anonymity | tor (client + torsocks), tor-browser | tor.nix |
| messengers | Signal, Element — as Flatpaks (nix-flatpak) for portal-confined execution | messaging.nix; Telegram not installed by default |
Operator home (home/modules/)
Section titled “Operator home (home/modules/)”| Area | Packages | Notes |
|---|---|---|
| shell | fish (vi mode), starship, kitty, zellij | identical settings to the macOS config |
| Rust CLI kit | eza, bat, fd, ripgrep, ripgrep-all, zoxide, skim, dust, xh, gping, trippy, bandwhich, rustscan, ouch, jaq, tailspin, hyperfine, tokei, procs, sd, btop, yazi, joshuto, tealdeer, lazygit, delta, difftastic | classic names aliased in fish (ls→eza, du→dust, curl→xh, …) |
| downloads | aria2 (RPC loopback-only), yt-dlp, qbittorrent-enhanced | |
| editors | neovim (+ neovim-remote), VSCodium with the pinned extension set | VSCodium instead of VS Code: no telemetry. Dropped ms-python.vscode-pylance (licence bound to Microsoft’s build; pyright LSP covers it). Switch back with programs.vscode.package = pkgs.vscode. |
| languages | Rust nightly (rust-overlay: rust-src, llvm-tools, rust-analyzer; wasm32 + musl targets) + cargo-{edit,outdated,audit,machete,expand,llvm-cov,zigbuild}, zig; Go; Python 3 env (aiohttp, numpy, pylsp stack, ipykernel, …); Node 26 + pnpm; deno; uv, pipx; luarocks | rust.nix, packages.nix |
| LSP/format | bash, ccls, dockerfile, fish, lua, pyright, stylua, nil, topiary, eslint, vscode-langservers, yaml-language-server, yamlfmt | |
| browser | Firefox + pinned arkenfox 144.0 + overrides, uBlock Origin (policy-installed) | firefox.nix |
| crypto/mail | gnupg + gpg-agent (SSH support, pinentry-qt), protonmail-bridge, protonmail-desktop, thunderbird | |
| GUI | mpv, inkscape, wireshark, xournalpp, qalculate-qt, easylpac | |
| misc CLI | caddy, mkcert, rclone, wget, rich-cli, trash-cli, 7zz, unar, ascii-image-converter, djvulibre, figlet, glow, gnuplot, imagemagick, librsvg, libqalculate, lolcat, lynx, numbat, pandoc, pngcrush, poppler-utils, w3m, tree-sitter, nix-prefetch, claude-code, wl-clipboard |
Opt-in (my.features) — decide per machine
Section titled “Opt-in (my.features) — decide per machine”| Toggle | Adds | Why not default |
|---|---|---|
zoom | zoom-us | proprietary conferencing client with broad system access; enable only if needed |
java | temurin-bin | large; only for JVM work |
julia | julia-bin | large; only for Julia work |
foundry | foundry (forge/cast/anvil) | Ethereum tooling; only for that work |
azure | azure-cli | large; cloud-specific |
android | Android SDK/emulator | several GiB, requires accepting Google’s licence; not yet ported |
killSwitch | nftables egress drop while mihomo is down (hardening/killswitch.nix) | captive portals unreachable while on; gives mihomo a static service user |
Dropped from the macOS manifest (platform-specific)
Section titled “Dropped from the macOS manifest (platform-specific)”iina, pinentry_mac, mas, ideviceinstaller, the .app wrappers, Homebrew casks, the Apple-Keychain secret helpers,
pyobjc-core, antigravity-cli/-ide (no Linux build), rayburst/motrix-next (not in Linux nixpkgs).
Deferred
Section titled “Deferred”Catppuccin Latte theming— done inhome/modules/theme.nix(pinned upstream theme files for bat, btop and yazi; kitty/starship/fish keep their own palettes).catppuccin/nixwas rejected: it imports from derivations at evaluation time.- Android SDK: port
androidenv.composeAndroidPackagesbehindmy.features.android. - Emacs: the operator’s emacs overlay is present but disabled in both source configs; not ported.